Live data from Hacker News

TXT Record XSS

who.is

231–236 of 236 posts

Re: TXT Record XSS

#231
post #165

Earlier quoted context omitted.

Aren't the IPs of the load balancers more or less fixed, though?

I'm not a netadmin, so don't know the innards of how it all works, but one day I watched a domain of ours pointing to an amazon load-balancer spread across multiple AZs - the IP address would change in DNS every so often, flipping between the AZs, presumably.

Implementations will differ for "elastic" software defined load balancing so understand this is not a definitive statement applicable to all cloud service providers. In the case of AWS a default ELB set to serve one zone might have one IP. If it is configured to serve to 3 zones it may then have 3 IP addresses. These are minimums and they do change randomly so AWS warns you not o set A Records to IPs of those.

This is not hardware. This is software defined networking which you should apply one of the rules of good cloud design which is to expect failure - and this is a feature - IPs change. Deal with it. ;)

Further we have the TTL issue noted and an very interesting thing happens there. If you use a default of say 300 or more seconds for your FQDN in the DNS record which has even a CNAME to an ELB set of FQDNs (if multiple ELBs for example) then your going to have a condition at some times where that 300 seconds is still ticking down when the say 60 second TTL for the ELB's fqdn expires and or the ELB IP itself has changed. In that time span your resolved IP may be assigned to another ELB and traffic going to your platform hits some other platform. So perhaps at the first 1 second mark of your 300 second TTL start the AWS ELB TTL has expired and perhaps is assigned to nothing - your traffic gets failure to connect - then the IP is assigned to some other FQDN and your traffic hits some other ELB. (Your church patrons now get porn perhaps.) The flip side is true and interesting to watch in logs.

How to take advantage of this feature? Oh that is fun. Marketing? Route all such identifiable traffic to good bad or ugly ends?

This situation should be expected.

Re: TXT Record XSS

#232

Earlier quoted context omitted.

I don't think this has to do with multiprocess. The instance of HTML engine (geckk?) just needs to track who used the audio API.

I think the problem with that is it doesn't work with Flash audio. With multiprocess browsers, the Flash audio can be associated with a tab, but that's awkward/not possible if everything is in the same process.

Chrome didn't have this feature for a very long time, and if anything sounded like it was actually harder because of how Chrome handles their processes.

Re: TXT Record XSS

#233
post #112

Earlier quoted context omitted.

When bytes count (and they often don't, but in this case they probably do), what would be your preferred system? And what do you see as your favoured approach's main advantage(s) over ASN.1/BER?

ASN.1/BER is a pain in the ass. I'd rather gzip json. Or poke chopsticks in my eyes. (creds: http://tools.ietf.org/html/rfc1697 )

MIBs are not ASN.1, actually.

Re: TXT Record XSS

#234
post #174

Earlier quoted context omitted.

False. IP fragmentation allows the size of a single UDP DNS response to be up to 65535 bytes, regardless of the network MTU.

It does not have to to with link, udp or ip it is a limitation of the dns spec. Here is a extention that "fixes" it: https://tools.ietf.org/html/draft-ietf-dnsind-udp-size-02 I have not seen that spec extention implemented in the wild. I just found the extention so I have on the other side not looked for it.

EDNS(0) allows for larger responses and is both commonly implemented and widely deployed.

http://tools.ietf.org/html/rfc6891

Re: TXT Record XSS

#235
post #162

Earlier quoted context omitted.

I think his point is that DNS doesn't require the TCP or HTTP overhead. There are more steps and layers involved with an HTTP GET and reply than with DNS resolution.

It requires TCP overhead if the dns packet is bigger than 512 bytes. You could abuse the DNS protocol to carry HTTP-esque metadata but it would be a small victory over standard HTTP. Reusing an existing TCP connection is more efficient.

TCP is not required for larger messages if EDNS(0) is available--which it probably is--and the network allows; which conservatively, it probably does at least till the 1280~1450 byte mark.

http://tools.ietf.org/html/rfc6891

Post reply on HN